Yesterday, a coworker informed me that a user had opened a malicious e-mail containing a .dotm document which she could not open.

I undertook the usual steps to prevent the malware from spreading to other servers.

But should I also notify users of what had taken place yesterday and to remind them of the dangers of such e-mails?

Note: The last time we had a (big) security breach, we did notify the users of what had happened. Both that and the one above were results of users opening malicious mails from unknown senders. I could understand that we should remind users of not opening mails from unknown senders, so such breaches can be avoided in the future. But my company does not specify whether we should notify users of security breaches (even if there almost was one)

  • 2
    What does your company's information security policy say? Specifically, is there a requirement to report suspicious attachments to IT? Do people? Is this a learning opportunity, as you suggest, or is this a failure of process (e.g. was it forwarded from someone within the company with a note saying "hey, I can't open this file, and I've been trying for ages!"?). Basically, too many variables to be answerable! – Matthew Mar 10 '16 at 12:55
  • There isn't anything that specify IF users should be notified, we mostly notify users if they have to migrate to other server(s) or if our servers were breached. But since we have had this problem before, I would say that a small reminder should be enough. – SP-Brown Mar 10 '16 at 13:28
  • 1
    If your company doesn't have a policy about disclosing security breaches I say you write one yourself, and submit it for review to your manager(s), have people agree on it or amend it, and act based on what that policy says – Purefan Mar 10 '16 at 13:32
  • What do you mean she couldn't open it? It's possible the malware created a dialog that pretended it couldn't be opened... – Mark Buffalo Mar 10 '16 at 15:21
  • I don't know what she exactly got when she opened it since I was absent at the time. I did asked for the mail to be send to my e-mail but it got blocked by our firewall (which it should have before it got send to the user) So I have not checked the attachment within that mail in a secure environment. – SP-Brown Mar 10 '16 at 15:44

From a pure information security perspective telling users there was a breach makes the threat more immediate and seem more applicable to them, however there are other considerations, for example:

  • business: If an internal email gets leaked does the company want a security breach to be public knowledge?
  • human resources: if someone was able to use details in the internal email to determine who opened the attachment that person may be subject to abuse, or it may breach their legal or contractual rights

Really it's a management decision as to how these things should be dealt with, ideally in the form of a process that implements a policy that is derived from a strategy. If you don't have any of that then kick it up the chain of command and do what they say.

| improve this answer | |
  • I will discuss it with the manager so that there will be at least some guidelines on how to handle such matters. It's always better to have something than nothing. – SP-Brown Mar 10 '16 at 13:46

It sounds like the breach in this case was avoided, so it may not be necessary to specifically notify the users about it.

What you could do instead is take this opportunity to remind users about proper precautions with attachments.

You're still being proactive, and cautious, but not giving more emphasis to this particular incident than it needs.

Unless your users regularly share dotm files, you really should be blocking these attachments at the email server. There's a fairly small number of file types that would legitimately need to be emailed around. Everything else should be blocked.

| improve this answer | |
  • I will keep that in mind and send out an e-mail reminding the users about opening malicious e-mails. We do keep such e-mails open to interpretation i.e. never disclose who caused the breach (since finger pointing is useless and some users feel partially guilty knowing that they could have been the reason of causing it all). – SP-Brown Mar 10 '16 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.